Read Python version from .python-version in CI image build.

Avoid hardcoding 3.12 in the Dockerfile so the CI image tracks the same source of truth as local tooling and uv sync.

Co-authored-by: Cursor <cursoragent@cursor.com>

docker/ci/Dockerfile

@@ -12,16 +12,17 @@ RUN apt-get update \
 COPY --from=ghcr.io/astral-sh/uv:0.7.0 /uv /usr/local/bin/uv
 
 ENV UV_PYTHON_INSTALL_DIR=/opt/uv-python \
-    UV_PYTHON=3.12 \
-    UV_LINK_MODE=copy \
-    PATH="/app/.venv/bin:${PATH}"
+    UV_LINK_MODE=copy
 
-RUN uv python install 3.12
+COPY .python-version /tmp/.python-version
+RUN uv python install "$(cat /tmp/.python-version)"
 
 WORKDIR /app
 
 COPY pyproject.toml uv.lock .python-version ./
 
+ENV PATH="/app/.venv/bin:${PATH}"
+
 RUN --mount=type=secret,id=uv_token \
     UV_INDEX_GITEA_USERNAME=ci-bot \
     UV_INDEX_GITEA_PASSWORD="$(cat /run/secrets/uv_token)" \

docs/ci-image.md

@@ -10,7 +10,7 @@ are cached cluster-wide via Harbor (see homelab-platform
 Built from [`docker/ci/Dockerfile`](../docker/ci/Dockerfile):
 
 - Node.js 20 (required by act_runner job containers)
-- Python 3.12 (installed via `uv python install`) and pinned `uv` 0.7.0
+- Python 3.12 (installed via `uv python install` from [`.python-version`](../.python-version)) and pinned `uv` 0.7.0
 - Docker CLI (integration tests via testcontainers)
 - Dev dependencies from `uv.lock` (`uv sync --all-extras --no-install-project`)